Glossary

Hypothesis Refinement

Adjusting a hunt hypothesis as evidence accumulates, narrowing, broadening, or pivoting it based on what the data shows, so the hunt stays productive rather than rigidly pursuing an initial guess.

Hypothesis Sources

The inputs that generate hunt hypotheses, threat intelligence, knowledge of attacker techniques (like MITRE ATT&CK), past incidents, anomalies in data, and environmental knowledge, that give hunters credible ideas worth investigating.

Hypothesis-Driven Hunting

A hunting approach that starts from a specific, testable hypothesis about attacker activity and then queries telemetry to confirm or refute it, contrasted with purely data-driven hunting that lets anomalies surface from the data.

IA Independence

The principle that an internal audit function must be organizationally independent and objective, reporting in a way that keeps it free from management influence, so its assessments of controls and risk are credible and unbiased.

IA Maturity

How developed an internal audit function is, from a basic, compliance-focused activity to a strategic, risk-based, value-adding function, used to assess where internal audit stands and how to advance its capability.

IA Methodology

The structured approach an internal audit function follows to plan and perform audits, risk-based planning, fieldwork and testing, evidence gathering, and reporting, so audits are consistent, rigorous, and aligned to risk.

IA Reporting

How an internal audit function communicates results, audit reports with findings, risk ratings, and recommendations to management, and summary reporting to the board or audit committee, so assurance leads to action and oversight.

IAM Architecture

The overall design of an organization's identity and access management, how identities, authentication, authorization, directories, and access controls fit together across systems, so access is secure, consistent, and manageable at scale.

IAM Architecture Patterns

Reusable, proven design approaches for structuring identity and access management, such as hub-and-spoke identity, centralized versus federated models, or standard provisioning and SSO designs, that engineers adapt rather than designing from scratch.

IAM Career Path

The progression of roles in identity and access management, from analyst or administrator through IAM engineer to architect and program leadership, with specializations like cloud IAM, IGA, or privileged access.

IAM Design Principles

The guiding principles for sound identity and access management design, such as least privilege, single identity, separation of duties, defense in depth, and automation, that shape secure, maintainable IAM architectures.

IAM Detection for Meridian

A capstone exercise applying identity threat detection to a fictional organization (Meridian), designing detections for identity-based attacks as part of building that organization's identity program end to end.

IAM Entitlement Management

Managing the fine-grained permissions (entitlements) that cloud identities hold, discovering, right-sizing, and governing them toward least privilege, since cloud IAM grants are numerous, complex, and easily over-provisioned.

IAM Gap Analysis

Assessing an organization's current identity and access management against a desired target state to identify gaps, weaknesses, missing capabilities, and risks, that the identity program needs to close.

IAM Policies

In the cloud, the documents that define what actions an identity may perform on which resources, the rules attached to users, roles, or resources that grant or deny specific permissions. They are how cloud access control is expressed.

IAM Privilege Escalation

Abusing cloud IAM misconfigurations to gain more permissions than originally granted, for example using a permission to modify policies or assume a more powerful role, a major focus of cloud security assessment.

IAM Program Assessment

Evaluating an entire identity and access management program, its capabilities, controls, maturity, and risks, to judge how well it is working and where it needs improvement, as a capstone view of an identity program.

IAM Program Design

Designing the overall identity and access management program, its capabilities, processes, controls, roadmap, and governance, so identity is managed coherently across the organization rather than as disconnected tools and tasks.

IAM Program Governance

The oversight structures that keep an identity program aligned, accountable, and effective, ownership, policies, access reviews, metrics, and decision-making, so identity management is governed rather than left to drift.

IAM Roles vs Users (Cloud)

The distinction between cloud users (long-lived identities for people, with standing credentials) and roles (assumable identities granting temporary credentials), a core cloud-IAM concept where roles are preferred to avoid static, leakable keys.

IAM Threat Detection

Detecting attacks against identity and access systems, anomalous logins, privilege escalation, suspicious entitlement changes, and credential abuse, since identity is a primary target and effective perimeter in modern environments.

ICMP

Internet Control Message Protocol: a network protocol used for diagnostics and error messages (such as ping and unreachable notifications). Defenders watch it because attackers can abuse it for scanning, tunneling, or covert channels.

ID Token

In OpenID Connect, a token the identity provider issues to prove a user's identity to an application, containing claims about who the user is and how they authenticated. It is how a relying party learns the user is authenticated.

IDOR

An insecure direct object reference where a user can access another user's object by changing an identifier.

IGA Implementation Patterns

Proven approaches for rolling out identity governance and administration, such as phased deployment, starting with high-risk applications, or focusing first on access certification, that help an IGA program succeed rather than stall.

IGA Implementation Realities

The practical challenges of implementing identity governance and administration, messy data, complex application integrations, organizational resistance, and scope creep, that make IGA projects hard and often longer than expected.

IGA Platform Functions

The core capabilities an identity governance and administration platform provides, access request and provisioning, access certification, role management, separation-of-duties enforcement, and identity analytics, that automate and govern access at scale.

IGA Platform Landscape

The market of identity governance and administration products and their differences, helping practitioners understand the available platforms, their strengths, and how to choose one suited to the organization's needs.

IGA Program Metrics

The measures used to track an identity governance program's health and value, such as certification completion rates, access-request turnaround, orphaned-account counts, and separation-of-duties violations, showing whether governance is working.

IGA Program Operations

The ongoing running of an identity governance program, executing access certifications, processing requests, maintaining roles, resolving violations, and reporting, so governance is sustained day to day rather than a one-time setup.

IMAP

Internet Message Access Protocol: a protocol email clients use to retrieve and manage messages stored on a mail server. Defenders care about it because attackers abuse IMAP access, often via stolen credentials, to read or exfiltrate mailboxes.